About the role
DevSecOps & Supply Chain Security Consultant
Role Summary
* Seeking a US Person with 10+ years of experience in secure software delivery, CI/CD and software supply-chain security. * The role covers secure SDLC, pipeline architecture and access, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependencies, secrets, SAST/DAST, containers, IaC, vulnerability governance and regulatory evidence. * The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions and remediation; produce audit-ready findings, release-readiness and residual-risk conclusions; and recommend finding-specific work. CRA, regulated-product and stakeholder-reporting experience is highly preferred.
Key Responsibilities
* Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability. * Review SDLC processes, tooling, and secure development practices * Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk * Evaluate CI/CD pipeline security, artifact integrity, and secure release controls * Review secrets management across development, build, deployment, and operational environments * Assess logging, auditability, and security event traceability controls * Evaluate vulnerability management, remediation tracking, and patch governance processes * Support lifecycle security assessment, compliance evidence mapping, and traceability * Contribute to assessment reporting, remediation guidance, and release governance reviews * Validate source-to-release traceability, build provenance, tamper resistance, artifact signing and promotion controls, SBOM accuracy, security gates, exceptions, remediation decisions, release-readiness conclusions and residual-risk positions. * Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, stakeholder-ready executive communication and recommendations for finding-specific follow-up work. * Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls, infrastructure-as-code and pipeline-as-code security, policy-as-code implementation and automated security-gate effectiveness.
Required Skills & Experience
Mandatory:
* Strong understanding of DevSecOps and secure software delivery practices * Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling * Familiarity with CI/CD security controls and artifact integrity validation * Experience with vulnerability management and dependency governance programs * Understanding of lifecycle security, auditability, and compliance evidence requirements * Experience with secrets management and secure release governance * SBOM Analysis (CycloneDX, SPDX, VEX/CSAF) * Artifact Integrity * SAST, DAST, Dependency & Secrets Scanning * Vulnerability Management & Remediation Governance * Secrets Management * Compliance Evidence & Audit Traceability * CRA / Regulatory Security Assessments * Syft and related SBOM tools * Secure Release Governance & Security Controls Validation * Build provenance and software-delivery traceability * Artifact signing, verification and tamper testing * Container, registry, build-agent and CI/CD runner security * Infrastructure-as-Code and pipeline-as-code security * Signing-key, certificate and HSM lifecycle controls * SBOM generation and binary-to-SBOM reconciliation * Open-source and third-party dependency governance * EOL/EOS and patch-lifecycle governance * Security exception and release-risk governance * Pipeline policy-as-code and automated security gates * Vulnerability metrics and release-readiness reporting * NIST SSDF and secure software supply-chain practices * Supplier security and software-acquisition assessments * Tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins and Azure DevOps * US Citizen or Green Card holder (US Person)
Good to have:
* Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments * Experience participating in engagement related to export-controlled environments * Familiarity with SLSA or modern software supply chain security practices * Strong documentation skills
Preferred Certifications
* CSSLP, Certified DevSecOps Professional or any other relevant product-security credentials
Years of Required Experience
* 10+ years in secure CI/CD pipeline setup, governance and controls validation, including setting up, maintaining and validating Secure CI/CD pipelines across different types of technology stacks. * 2+ years of hands-on SBOM analysis experience.